[GH-ISSUE #1265] [Security] Insecure permission for Resellers users' domain view. #1024

New issue

Closed

opened 2026-02-27 11:14:48 +03:00 by kerem · 0 comments

kerem commented

2026-02-27 11:14:48 +03:00

Owner

Originally created by @pavinjosdev on GitHub (Oct 8, 2017).
Original GitHub issue: https://github.com/modoboa/modoboa/issues/1265

Impacted versions

Modoboa: 1.8.1-1.9.0
installer used: Yes
Webserver: Nginx

Steps to reproduce

Create a domain as admin/Resellers user.
Create a Resellers user
Login as above Resellers user and create a domain
URL of new domain (assuming this is the second domain in this modoboa instance) will be https://hostname.domain.tld/admin/domains/2/
Go to https://hostname.domain.tld/admin/domains/1/ and the first domain (created by another user) will be visible. Similarly for numbers above 2 if there are more domains added by other users.

Current behavior

Changing the domain number in URL will show domains to Resellers user to which he has no permission. Currently this security issue applies to any user with a domain view including Resellers, Domain administrators, etc.

Expected behavior

Changing the domain number in URL should not show domains to Resellers user to which he has no permission. He should be redirected to login.

Video/Screenshot link (optional)

Originally created by @pavinjosdev on GitHub (Oct 8, 2017). Original GitHub issue: https://github.com/modoboa/modoboa/issues/1265 # Impacted versions * Modoboa: 1.8.1-1.9.0 * installer used: Yes * Webserver: Nginx # Steps to reproduce 1. Create a domain as admin/Resellers user. 2. Create a Resellers user 3. Login as above Resellers user and create a domain 4. URL of new domain (assuming this is the second domain in this modoboa instance) will be https://hostname.domain.tld/admin/domains/2/ 5. Go to https://hostname.domain.tld/admin/domains/1/ and the first domain (created by another user) will be visible. Similarly for numbers above 2 if there are more domains added by other users. # Current behavior Changing the domain number in URL will show domains to Resellers user to which he has no permission. Currently this security issue applies to any user with a domain view including Resellers, Domain administrators, etc. # Expected behavior Changing the domain number in URL should not show domains to Resellers user to which he has no permission. He should be redirected to login. # Video/Screenshot link (optional)